gcp-certmanager-sign-via-execute-as

A principal that can execute as a workload SA holding certificateRequester can issue certs.

derived gcp emits CanSignAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
source	`<principal>`
target	`<CA pool ?sa can issue from>`
permissions	`privateca.certificates.create` `privateca.caPools.use`
conditions	`iam_permission` `key_permission`
state logic	Inherits state from the CanExecuteAs input; then ACTIVE if ?sa holds both issuance permissions and the CA is ENABLED (non-KMS-backed OR service agent holds useToSign); CONDITIONAL(key_permission) if KMS-backed and the service-agent grant is unknown; BLOCKED if denied by VPC-SC/IAM deny/KMS or the CA is DISABLED.

source type

Identity

source

<principal>

target

<CA pool ?sa can issue from>

permissions

privateca.certificates.create privateca.caPools.use

conditions

iam_permission key_permission

state logic

Inherits state from the CanExecuteAs input; then ACTIVE if ?sa holds both issuance permissions and the CA is ENABLED (non-KMS-backed OR service agent holds useToSign); CONDITIONAL(key_permission) if KMS-backed and the service-agent grant is unknown; BLOCKED if denied by VPC-SC/IAM deny/KMS or the CA is DISABLED.

Narrative

{principal.name}, able to execute as {sa.name}, can issue certificates from {capool.name} because {sa.name} holds certificateRequester on it.

Raw rule rules/derived/gcp/certmanager.yaml

id: gcp-certmanager-sign-via-execute-as
emits: CanSignAs
description: A principal that can execute as a workload SA holding certificateRequester can issue certs.
match:
- - principal: null
  - CanExecuteAs
  - sa: null
where:
- ?sa has EFFECTIVE privateca.certificates.create AND privateca.caPools.use on ?capool (per-pool or inherited)
- node_type(?capool) == CaPool (SigningKey)
- the pool has an ENABLED CA
emit:
  source_type: Identity
  source: <principal>
  target: <CA pool ?sa can issue from>
  permissions:
  - privateca.certificates.create
  - privateca.caPools.use
  conditions:
  - iam_permission
  - key_permission
  state_logic: Inherits state from the CanExecuteAs input; then ACTIVE if ?sa holds both issuance permissions
    and the CA is ENABLED (non-KMS-backed OR service agent holds useToSign); CONDITIONAL(key_permission)
    if KMS-backed and the service-agent grant is unknown; BLOCKED if denied by VPC-SC/IAM deny/KMS or
    the CA is DISABLED.
  confidence: min(contributing_confidences) * 0.93
  derived_from:
  - <CanExecuteAs edge_id>
  - <?sa privateca.certificates.create + caPools.use grants>
  false_positive_note: 'Requires the WORKLOAD SA (not the principal directly) to hold BOTH issuance permissions
    on the specific pool. Canonical CanExecuteAs -> CanSignAs completion: once code runs as ?sa, it issues
    certs via the SA''s metadata token. Do not emit if ?sa''s grant is scoped to a different pool. The
    downstream forgery/trust gates still apply on the chained CanImpersonate.'
  narrative: '{principal.name}, able to execute as {sa.name}, can issue certificates from {capool.name}
    because {sa.name} holds certificateRequester on it.'